Where we work · Tonga
ISO and GRC certification consulting in Tonga
Achieve ISO and GRC certification in Tonga with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Sydney office team
- Effivity and Academy included
Sectors that ask for certification in Tonga
Clients include
In short
ISO and GRC certification in Tonga at a glance
Tonga's own laws, published by the Attorney General's Office in English and Tongan, explain much of the demand for ISO and GRC work. The Food Act 2020 requires a food licence or permit and vests the National Food Authority in the Minister responsible for food, while the Fisheries Management (Processing and Export) Regulations 2008 make a licence to export fish depend on a HACCP system. The Cybersecurity Act 2025 sets incident reporting and assessment duties for designated critical infrastructure, and the Privacy Act 2025 creates a Privacy Commission and rules for personal information; both come into force on a date proclaimed by Cabinet. Public bodies follow the Public Procurement Regulations, which let each tender set its own certification and testing requirements. Tonga Statistics Department figures for the second quarter of 2026 show root crops, kava and fish at the top of domestic exports. Certificates for Tongan organisations normally carry accreditation from a body in another economy, and accredited certification bodies issue them, never Sterling. Sterling's Sydney office serves Tongan clients on site and remotely, with 8,100+ client engagements in 60+ countries, 20+ years of practice, and Effivity and Sterling Academy included with every engagement.
Explore
ISO and GRC standards Sterling delivers in Tonga
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
ISO 22301Sterling guide to the standardISO 37001Sterling guide to the standardISO 37301Sterling guide to the standard
Financial services, payments & AML
Food safety & agriculture
FSSC 22000Sterling guide to the standardHACCPSterling guide to the standardISO 22000Sterling guide to the standard
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Tonga (19)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Privacy Act 2025 the Privacy Commission established by section 7, run by a Privacy Commissioner appointed under section 11; section 69 lets the Minister make transitional arrangements for the Attorney-General to ensure compliance until a Commissioner is appointed | The Act applies to a data controller or data processor established in the Kingdom, processing within the Kingdom, or targeting goods or services at people in the Kingdom (section 5). It sets lawful bases and consent rules (sections 27 to 31), notice to data subjects at collection (section 33), minimisation and retention limits (sections 32 and 34), written arrangements with processors (section 35), security measures (section 36), notice of breaches to the Commission (section 37, which the Act defers until the second anniversary of commencement), restrictions on transfers outside the Kingdom (sections 39 and 40), documented policies and a complaints process (section 41) and data subject rights (sections 42 to 47). The Minister may require registration of controllers and processors by regulations (section 22). The Act names certification mechanisms as one way a recipient abroad can show adequate protection but does not cite ISO/IEC 27001 or ISO/IEC 27701. | |
| Personal Health Information Protection Act 2025 the Chief Executive Officer responsible for health, who receives complaints under the Act, and the Ministry of Health, which develops and maintains the national health information system | Sets rules for the access, collection, use and disclosure of personal health information by health information custodians, a class that includes health care practitioners, hospital operators and pharmacy operators, and gives people rights to access and correct their own health information. It does not cite ISO/IEC 27001 or ISO/IEC 27701. | |
| the National Food Authority, which section 14 of the Act vests in the Minister responsible for food, supported by the Ministry's Food Division and a National Food Council food businesses, food licences and food exports | Food Act 2020 (Act 3 of 2020), assented to on 29 October 2020: a person who operates or intends to operate a food business applies for a food licence or food permit, owners follow prescribed premises standards, hygiene rules and traceability, labels are in English or Tongan, no food is exported without the Authority's certification that it is fit for human consumption, made to prescribed standards and acceptable to the importing country, and the Authority is the competent authority for that export certification. Food standards are to be consistent with Codex, and Codex standards apply as regulations until national food standards are made. The Act does not name HACCP, ISO 22000 or FSSC 22000. | |
| the Minister responsible for fisheries and the Ministry's licensing and inspection officers fisheries processing and fish exports | Fisheries Management Act 2002 and the Fisheries Management (Processing and Export) Regulations 2008, in effect from 6 June 2008: a fish processing establishment is registered and licensed, and a licence to export fish for commercial purposes is conditional on processing in a licensed establishment under an effective HACCP system, a HACCP Plan prepared and monitored by a person trained in HACCP principles or by a seafood safety inspector, evidence that the exporter can consistently meet microbial, toxin, chemical and physical contamination standards, and a health certificate with every consignment. The Regulations define HACCP by reference to the Codex Alimentarius and do not name ISO 22000. | HACCP |
| the Minister responsible for cybersecurity policy and regulation, the Minister responsible for cybersecurity operations and the Computer Emergency Response Team (CERT) established by the Act, with a Cybersecurity Advisory Board cybersecurity and critical infrastructure | Cybersecurity Act 2025 (Act 14 of 2025), assented to on 28 August 2025, which comes into force on a date proclaimed by Cabinet: the Minister designates critical infrastructure, which may cover electronic communications, banking and financial services, electrical energy, public transport and other public services; the Minister may publish minimum standards and audit and inspect critical infrastructure; operators submit periodic cybersecurity assessments, report cybersecurity incidents to the CERT within 24 hours of becoming aware, take ordered remedial action and keep documented policies, practices, procedures and compliance records. The Act does not name ISO/IEC 27001. | |
| the National Reserve Bank of Tonga, which the Banking Act 2020 calls the Reserve Bank banking | Banking Act 2020 (Act 27 of 2020), assented to on 25 February 2021: a person applies in writing to the Reserve Bank for a licence to operate a banking business, and only a bank licensed under the Act may use the word bank in its name. The Act does not cite ISO/IEC 27001 or PCI DSS. | |
| the Ministry responsible for the environment and its Chief Executive Officer, with an Environmental Assessment Committee environmental protection and project assessment | Environment Management Act, whose Ministry coordinates the Government's response to environmental matters, monitors impacts on the environment and may issue notices, and the Environmental Impact Assessment Act, under which all major projects are supported by an environmental impact assessment and the Minister determines the assessment, regarding pollution, hazards and ecosystems among other effects. Neither Act cites ISO 14001. | |
| the Competent Authority for the Kingdom appointed under section 17 of the Act hazardous wastes and chemicals | Hazardous Wastes and Chemicals Act: persons managing hazardous substances take all practicable steps to reduce hazardous waste, store and manage substances to prevent pollution, dispose of them only at approved sites, protect the health of employees handling them, including through training, keep records and registers, hold the required licences and prepare a management plan. The Act does not cite ISO 14001 or ISO 45001. | |
| the Building Control Authority and the Building Controller, who is the Director of Works building and construction | Building Control and Standards Act, in effect from 4 March 2004: every person intending to erect a building first obtains a building permit from the Building Controller as the Regulations prescribe, and the Act also provides for stop-work notices and notices of compliance. The Act does not cite ISO 9001, ISO 14001 or ISO 45001. | |
| the Competent Authority established under the Price and Wage Control Act, which the Consumer Protection Act 2025 calls the Authority, and the Chief Executive Officer of the Ministry responsible for consumer affairs consumer goods and services | Consumer Protection Act 2025 (Act 39 of 2025), assented to on 16 December 2025, which comes into force on a day proclaimed by Cabinet: it provides for consumer information standards, product safety standards for goods and safety standards for services, and the Authority's functions extend beyond those under the Price and Wage Control Act. The Act does not name an ISO standard. | |
| the Ministry responsible for energy, its Energy Department and enforcement officers energy-using products | Minimum Energy Performance Standards and Labelling Regulations 2025, made under the Energy Act 2021: regulated product classes listed in Schedule 1 carry minimum energy performance and labelling requirements, enforcement officers may inspect the premises of traders and manufacturers during business hours, and goods may be removed from sale after a breach. The Regulations treat a product as registered where it is registered in Australia or New Zealand for the listed class. They do not cite ISO 50001. | |
| the Anti-Corruption Commissioner anti-corruption | Anti-Corruption Commissioner Act (Cap 2.01, 2020 Revised Edition): the Commissioner investigates corrupt conduct, which includes dishonest or partial exercise of official functions, breach of public trust and misuse of official information, with powers to examine people, hold public inquiries and use search warrants; public authorities include Government departments, statutory bodies and public enterprises. The Act does not cite ISO 37001. | |
| the Minister, under the Public Enterprises Act public enterprises | Public Enterprises Act (Cap 32.09, 2016 Revised Edition): the principal objective of every public enterprise is to operate as a successful business, as profitable and efficient as comparable businesses that are not state owned, and the Act requires business plans and half-yearly reports. The Act does not cite ISO 9001 or ISO 37301. | |
| the Chief Executive Officer of the Government ministry responsible for emergency management emergency management and essential services | Emergency Management Act: defines an emergency as an actual or imminent event that endangers life, property or the environment and needs a significant and co-ordinated response, with a failure of an essential service or infrastructure listed among the events, and provides for emergency management arrangements. The Act does not cite ISO 22301. | |
| authorised police officers and the courts, for the offences under the Computer Crimes Act electronic records and computer misuse | Electronic Transactions Act 2025 (Act 5 of 2025) and Computer Crimes Act 2025 (Act 15 of 2025), each assented to on 28 August 2025 and each coming into force on a date proclaimed by Cabinet: the first lets certain paper-based legal requirements be met by functionally equivalent electronic technology, and the second creates computer-related offences and procedures for authorised officers. Neither Act cites ISO/IEC 27001. | |
| the Pharmacy Board established under the Pharmacy Act pharmacies and medicinal drugs | Pharmacy Act (Cap 28.28, 2016 Revised Edition), in effect from 1 January 2004: pharmacists and assistant pharmacists are registered, pharmacy premises are licensed and complaints and disciplinary proceedings are provided for. The Act does not cite ISO 13485. | |
| the Director of Civil Aviation appointed under the Civil Aviation Act 2014 civil aviation | Civil Aviation Act 2014 (Cap 49.06), in effect from 15 January 2015: the Director controls entry into the civil aviation system by granting aviation documents, and rules made under the Act may require an aviation document for, among others, aircraft maintenance personnel and aircraft design, manufacture and maintenance organisations. The Act does not cite AS9100. | |
| the Tonga Tourism Authority tourism | Tonga Tourism Authority Act 2012: the Authority implements strategies and plans for the tourism sector, markets the Kingdom locally and internationally, works with the private sector to deliver tourism, assists Government with investment strategies for tourism and promotes human resource development in the industry. The Act does not cite an ISO standard. | |
| the Chief Executive Officer of the Government ministry responsible for commerce, and the Registrar of Business Licences foreign investment and business licensing | Foreign Investment Act (Cap 38.18): a foreign investment business holds a foreign investment registration certificate issued by the Chief Executive Officer, who keeps a register of certificates and monitors foreign investment, and the Act refuses certificates for prohibited and reserved activities; the Business Licences Act, in effect from 2 April 2007, provides for the licensing of business activities and a Business Licence Register. Neither Act cites an ISO standard. |
Accreditation and recognition
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Government procurement under the Public Procurement Regulations (Cap 04.32.7, 2016 Revised Edition) (the Government Procurement Committee and the Procurement Division under the Chief Executive Officer, working with the contracting entity's procurement unit): The Regulations, in effect from 17 July 2015, require a contracting entity to set out its quality and quantity requirements, including any certification, testing and test methods, clearly in the bidding documents. Requirements include any applicable standards, which refer to international standards or national standards incorporating them where possible, and bidder qualification criteria are limited to professional and technical qualifications, financial resources, equipment, managerial capability, experience, reputation and personnel. No general rule requiring ISO certification is recorded; each tender states its own criteria.
Sterling in Tonga
Sterling delivers in Tonga from its Sydney office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Tonga clients ask
Who regulates food safety and food exports in Tonga?
The Food Act 2020 vests the National Food Authority in the Minister responsible for food. A person who runs or plans to run a food business applies for a food licence or permit, and no food is exported unless the Authority certifies it fit for human consumption and acceptable to the importing country. Ask the Ministry how the licence classes apply to your premises.
What does exporting fish from Tonga require?
A licence to export fish for commercial purposes, which is conditional on a licensed fish processing establishment and an effective HACCP system. The HACCP Plan is prepared and monitored by a person trained in HACCP principles or by a seafood safety inspector, and every consignment carries a health certificate. The Fisheries Management (Processing and Export) Regulations 2008 set these conditions; check current forms with the fisheries ministry.
Does Tonga have a privacy law?
Yes. The Privacy Act 2025 (Act 34 of 2025) is enacted; commencement not yet confirmed from an official source. It sets rules on lawful processing, security, breaches, transfers abroad and data subject rights, enforced by a Privacy Commission. Section 1(2) says the Act comes into force on a date proclaimed by Cabinet, so confirm the commencement position with your counsel before relying on any section.
Which Tongan law covers cyber incidents at critical infrastructure?
The Cybersecurity Act 2025, which comes into force on a date proclaimed by Cabinet. Operators of designated critical infrastructure report cybersecurity incidents to the Computer Emergency Response Team within 24 hours of becoming aware, submit periodic assessments and keep documented policies and records. The Act does not name ISO/IEC 27001, so ask the responsible Ministry which evidence it will expect.
How does the Tongan Government procure goods and services?
Through the Public Procurement Regulations, which put a Government Procurement Committee and a Procurement Division in charge. Bidding documents set out quality requirements, including any certification and testing, and refer to international standards where possible. Qualification criteria must not be unduly restrictive, and no general ISO certificate rule is recorded, so read each tender's own criteria.
Which accreditation do certificates for Tongan organisations carry?
Usually accreditation from a body in another economy, since certificates for Tongan organisations are issued under the international arrangements of Global ACI. Ask any certification body you shortlist for its accreditation certificate and scope, then confirm with your buyer or regulator that it accepts that accreditation. Sterling prepares the management system but does not audit or certify.
Next step
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Privacy Act 2025 — ago.gov.to (accessed 18 Oct 2026)
- Personal Health Information Protection Act 2025 — ago.gov.to (accessed 18 Oct 2026)
- Food Act 2020 (Act 3 of 2020), assented to on 29 October 2020: a person who operates or intends to operate a food business applies for a food licence or food permit, owners follow prescribed premises standards, hygiene rules and traceability, labels are in English or Tongan, no food is exported without the Authority's certification that it is fit for human consumption, made to prescribed standards and acceptable to the importing country, and the Authority is the competent authority for that export certification. Food standards are to be consistent with Codex, and Codex standards apply as regulations until national food standards are made. The Act does not name HACCP, ISO 22000 or FSSC 22000. — ago.gov.to (accessed 18 Oct 2026)
- Fisheries Management Act 2002 and the Fisheries Management (Processing and Export) Regulations 2008, in effect from 6 June 2008: a fish processing establishment is registered and licensed, and a licence to export fish for commercial purposes is conditional on processing in a licensed establishment under an effective HACCP system, a HACCP Plan prepared and monitored by a person trained in HACCP principles or by a seafood safety inspector, evidence that the exporter can consistently meet microbial, toxin, chemical and physical contamination standards, and a health certificate with every consignment. The Regulations define HACCP by reference to the Codex Alimentarius and do not name ISO 22000. — ago.gov.to (accessed 18 Oct 2026)
- Cybersecurity Act 2025 (Act 14 of 2025), assented to on 28 August 2025, which comes into force on a date proclaimed by Cabinet: the Minister designates critical infrastructure, which may cover electronic communications, banking and financial services, electrical energy, public transport and other public services; the Minister may publish minimum standards and audit and inspect critical infrastructure; operators submit periodic cybersecurity assessments, report cybersecurity incidents to the CERT within 24 hours of becoming aware, take ordered remedial action and keep documented policies, practices, procedures and compliance records. The Act does not name ISO/IEC 27001. — ago.gov.to (accessed 18 Oct 2026)
- Banking Act 2020 (Act 27 of 2020), assented to on 25 February 2021: a person applies in writing to the Reserve Bank for a licence to operate a banking business, and only a bank licensed under the Act may use the word bank in its name. The Act does not cite ISO/IEC 27001 or PCI DSS. — ago.gov.to (accessed 18 Oct 2026)
- Environment Management Act, whose Ministry coordinates the Government's response to environmental matters, monitors impacts on the environment and may issue notices, and the Environmental Impact Assessment Act, under which all major projects are supported by an environmental impact assessment and the Minister determines the assessment, regarding pollution, hazards and ecosystems among other effects. Neither Act cites ISO 14001. — ago.gov.to (accessed 18 Oct 2026)
- Hazardous Wastes and Chemicals Act: persons managing hazardous substances take all practicable steps to reduce hazardous waste, store and manage substances to prevent pollution, dispose of them only at approved sites, protect the health of employees handling them, including through training, keep records and registers, hold the required licences and prepare a management plan. The Act does not cite ISO 14001 or ISO 45001. — ago.gov.to (accessed 18 Oct 2026)
- Building Control and Standards Act, in effect from 4 March 2004: every person intending to erect a building first obtains a building permit from the Building Controller as the Regulations prescribe, and the Act also provides for stop-work notices and notices of compliance. The Act does not cite ISO 9001, ISO 14001 or ISO 45001. — ago.gov.to (accessed 18 Oct 2026)
- Consumer Protection Act 2025 (Act 39 of 2025), assented to on 16 December 2025, which comes into force on a day proclaimed by Cabinet: it provides for consumer information standards, product safety standards for goods and safety standards for services, and the Authority's functions extend beyond those under the Price and Wage Control Act. The Act does not name an ISO standard. — ago.gov.to (accessed 18 Oct 2026)
- Minimum Energy Performance Standards and Labelling Regulations 2025, made under the Energy Act 2021: regulated product classes listed in Schedule 1 carry minimum energy performance and labelling requirements, enforcement officers may inspect the premises of traders and manufacturers during business hours, and goods may be removed from sale after a breach. The Regulations treat a product as registered where it is registered in Australia or New Zealand for the listed class. They do not cite ISO 50001. — ago.gov.to (accessed 18 Oct 2026)
- Anti-Corruption Commissioner Act (Cap 2.01, 2020 Revised Edition): the Commissioner investigates corrupt conduct, which includes dishonest or partial exercise of official functions, breach of public trust and misuse of official information, with powers to examine people, hold public inquiries and use search warrants; public authorities include Government departments, statutory bodies and public enterprises. The Act does not cite ISO 37001. — ago.gov.to (accessed 18 Oct 2026)
- Public Enterprises Act (Cap 32.09, 2016 Revised Edition): the principal objective of every public enterprise is to operate as a successful business, as profitable and efficient as comparable businesses that are not state owned, and the Act requires business plans and half-yearly reports. The Act does not cite ISO 9001 or ISO 37301. — ago.gov.to (accessed 18 Oct 2026)
- Emergency Management Act: defines an emergency as an actual or imminent event that endangers life, property or the environment and needs a significant and co-ordinated response, with a failure of an essential service or infrastructure listed among the events, and provides for emergency management arrangements. The Act does not cite ISO 22301. — ago.gov.to (accessed 18 Oct 2026)
- Electronic Transactions Act 2025 (Act 5 of 2025) and Computer Crimes Act 2025 (Act 15 of 2025), each assented to on 28 August 2025 and each coming into force on a date proclaimed by Cabinet: the first lets certain paper-based legal requirements be met by functionally equivalent electronic technology, and the second creates computer-related offences and procedures for authorised officers. Neither Act cites ISO/IEC 27001. — ago.gov.to (accessed 18 Oct 2026)
- Pharmacy Act (Cap 28.28, 2016 Revised Edition), in effect from 1 January 2004: pharmacists and assistant pharmacists are registered, pharmacy premises are licensed and complaints and disciplinary proceedings are provided for. The Act does not cite ISO 13485. — ago.gov.to (accessed 18 Oct 2026)
- Civil Aviation Act 2014 (Cap 49.06), in effect from 15 January 2015: the Director controls entry into the civil aviation system by granting aviation documents, and rules made under the Act may require an aviation document for, among others, aircraft maintenance personnel and aircraft design, manufacture and maintenance organisations. The Act does not cite AS9100. — ago.gov.to (accessed 18 Oct 2026)
- Tonga Tourism Authority Act 2012: the Authority implements strategies and plans for the tourism sector, markets the Kingdom locally and internationally, works with the private sector to deliver tourism, assists Government with investment strategies for tourism and promotes human resource development in the industry. The Act does not cite an ISO standard. — ago.gov.to (accessed 18 Oct 2026)
- Foreign Investment Act (Cap 38.18): a foreign investment business holds a foreign investment registration certificate issued by the Chief Executive Officer, who keeps a register of certificates and monitors foreign investment, and the Act refuses certificates for prohibited and reserved activities; the Business Licences Act, in effect from 2 April 2007, provides for the licensing of business activities and a Business Licence Register. Neither Act cites an ISO standard. — ago.gov.to (accessed 18 Oct 2026)
- Government procurement under the Public Procurement Regulations (Cap 04.32.7, 2016 Revised Edition) — ago.gov.to (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Sydney team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
australia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice